From 42af636589813a22aa6579eb9bdbf2a6cf0c0b55 Mon Sep 17 00:00:00 2001 From: erebion Date: Wed, 14 Dec 2022 17:43:16 +0100 Subject: [PATCH] initial commit --- ansible-checkmode-command-unhb4.sh | 2 + ansible-deploy-command-unhb4.sh | 2 + inventory.yml | 7 +++ roles/apt-update-upgrade/tasks/main.yml | 8 +++ roles/apt/handlers/main.yml | 9 ++++ roles/apt/tasks/apt.yml | 17 ++++++ roles/apt/tasks/main.yml | 6 +++ roles/apt/templates/10periodic.j2 | 4 ++ roles/apt_listchanges/files/listchanges.conf | 9 ++++ .../tasks/apt-listchanges-conf.yml | 17 ++++++ roles/apt_listchanges/tasks/main.yml | 8 +++ .../files/97-update.conf | 1 + .../files/debian_earlyoom | 28 ++++++++++ roles/basic_common_settings/handlers/main.yml | 8 +++ .../basic_common_settings/tasks/earlyoom.yml | 17 ++++++ roles/basic_common_settings/tasks/main.yml | 16 ++++++ roles/basic_common_settings/tasks/sudo.yml | 17 ++++++ .../tasks/update_script.yml | 42 +++++++++++++++ .../tasks/useful_packages.yml | 26 +++++++++ .../basic_common_settings/tasks/zsh_skel.yml | 44 +++++++++++++++ .../templates/update.sh.j2 | 23 ++++++++ roles/firewalld/.yamllint | 33 ++++++++++++ roles/firewalld/README.md | 38 +++++++++++++ roles/firewalld/handlers/main.yml | 2 + roles/firewalld/meta/main.yml | 53 +++++++++++++++++++ .../firewalld/molecule/default/Dockerfile.j2 | 2 + roles/firewalld/molecule/default/converge.yml | 8 +++ roles/firewalld/molecule/default/molecule.yml | 13 +++++ roles/firewalld/molecule/default/verify.yml | 10 ++++ roles/firewalld/tasks/main.yml | 37 +++++++++++++ roles/firewalld/tests/inventory | 2 + roles/firewalld/tests/test.yml | 5 ++ site.yml | 8 +++ 33 files changed, 522 insertions(+) create mode 100755 ansible-checkmode-command-unhb4.sh create mode 100755 ansible-deploy-command-unhb4.sh create mode 100644 inventory.yml create mode 100644 roles/apt-update-upgrade/tasks/main.yml create mode 100644 roles/apt/handlers/main.yml create mode 100644 roles/apt/tasks/apt.yml create mode 100644 roles/apt/tasks/main.yml create mode 100644 roles/apt/templates/10periodic.j2 create mode 100644 roles/apt_listchanges/files/listchanges.conf create mode 100644 roles/apt_listchanges/tasks/apt-listchanges-conf.yml create mode 100644 roles/apt_listchanges/tasks/main.yml create mode 100644 roles/basic_common_settings/files/97-update.conf create mode 100644 roles/basic_common_settings/files/debian_earlyoom create mode 100644 roles/basic_common_settings/handlers/main.yml create mode 100644 roles/basic_common_settings/tasks/earlyoom.yml create mode 100644 roles/basic_common_settings/tasks/main.yml create mode 100644 roles/basic_common_settings/tasks/sudo.yml create mode 100644 roles/basic_common_settings/tasks/update_script.yml create mode 100644 roles/basic_common_settings/tasks/useful_packages.yml create mode 100644 roles/basic_common_settings/tasks/zsh_skel.yml create mode 100755 roles/basic_common_settings/templates/update.sh.j2 create mode 100644 roles/firewalld/.yamllint create mode 100644 roles/firewalld/README.md create mode 100644 roles/firewalld/handlers/main.yml create mode 100644 roles/firewalld/meta/main.yml create mode 100644 roles/firewalld/molecule/default/Dockerfile.j2 create mode 100644 roles/firewalld/molecule/default/converge.yml create mode 100644 roles/firewalld/molecule/default/molecule.yml create mode 100644 roles/firewalld/molecule/default/verify.yml create mode 100644 roles/firewalld/tasks/main.yml create mode 100644 roles/firewalld/tests/inventory create mode 100644 roles/firewalld/tests/test.yml create mode 100644 site.yml diff --git a/ansible-checkmode-command-unhb4.sh b/ansible-checkmode-command-unhb4.sh new file mode 100755 index 0000000..76eadab --- /dev/null +++ b/ansible-checkmode-command-unhb4.sh @@ -0,0 +1,2 @@ +#!/bin/bash +ansible-playbook site.yml -i inventory.yml --limit unhb4 diff --git a/ansible-deploy-command-unhb4.sh b/ansible-deploy-command-unhb4.sh new file mode 100755 index 0000000..2f22dd0 --- /dev/null +++ b/ansible-deploy-command-unhb4.sh @@ -0,0 +1,2 @@ +#!/bin/bash +ansible-playbook site.yml -i inventory.yml --limit unhb4 --check --diff diff --git a/inventory.yml b/inventory.yml new file mode 100644 index 0000000..bce79b8 --- /dev/null +++ b/inventory.yml @@ -0,0 +1,7 @@ +--- + +all: + children: + debianservers: + hosts: + unhb4 diff --git a/roles/apt-update-upgrade/tasks/main.yml b/roles/apt-update-upgrade/tasks/main.yml new file mode 100644 index 0000000..5b069b0 --- /dev/null +++ b/roles/apt-update-upgrade/tasks/main.yml @@ -0,0 +1,8 @@ +--- + +- name: Update and upgrade apt packages + become: "true" + apt: + upgrade: yes + update_cache: yes + cache_valid_time: 3600 #an hour diff --git a/roles/apt/handlers/main.yml b/roles/apt/handlers/main.yml new file mode 100644 index 0000000..114a59b --- /dev/null +++ b/roles/apt/handlers/main.yml @@ -0,0 +1,9 @@ +--- +# handlers file for matrix_synapse + +- name: restart-unattendedupgrades + ansible.builtin.service: + state: restarted + daemon_reload: yes + name: unattended-upgrades + tags: molecule-notest diff --git a/roles/apt/tasks/apt.yml b/roles/apt/tasks/apt.yml new file mode 100644 index 0000000..e347896 --- /dev/null +++ b/roles/apt/tasks/apt.yml @@ -0,0 +1,17 @@ +--- + +- name: Install packages if Debian based + apt: + name: unattended-upgrades + state: present + update_cache: true + become: true + +- name: Apt Config (/etc/apt.conf.d/10periodic) + ansible.builtin.template: + src: ../templates/10periodic.j2 + dest: /etc/apt/apt.conf.d/10periodic + owner: root + group: root + mode: '0644' + notify: restart-unattendedupgrades diff --git a/roles/apt/tasks/main.yml b/roles/apt/tasks/main.yml new file mode 100644 index 0000000..88727c0 --- /dev/null +++ b/roles/apt/tasks/main.yml @@ -0,0 +1,6 @@ +--- + +- name: Include other yaml files + include_tasks: "{{ item }}" + with_fileglob: + - apt.yml diff --git a/roles/apt/templates/10periodic.j2 b/roles/apt/templates/10periodic.j2 new file mode 100644 index 0000000..70a2993 --- /dev/null +++ b/roles/apt/templates/10periodic.j2 @@ -0,0 +1,4 @@ +APT::Periodic::Update-Package-Lists "{{ APT_Periodic_Update_Package_Lists }}"; +APT::Periodic::Download-Upgradeable-Packages "{{ APT_Periodic_Download_Upgradeable_Packages }}"; +APT::Periodic::AutocleanInterval "{{ APT_Periodic_AutocleanInterval }}"; +APT::Periodic::Unattended-Upgrade "{{ APT_Periodic_Unattended_Upgrade }}"; diff --git a/roles/apt_listchanges/files/listchanges.conf b/roles/apt_listchanges/files/listchanges.conf new file mode 100644 index 0000000..cf889ab --- /dev/null +++ b/roles/apt_listchanges/files/listchanges.conf @@ -0,0 +1,9 @@ +[apt] +frontend=pager +which=news +email_address=none +email_format=text +confirm=false +headers=false +reverse=true +save_seen=/var/lib/apt/listchanges.db diff --git a/roles/apt_listchanges/tasks/apt-listchanges-conf.yml b/roles/apt_listchanges/tasks/apt-listchanges-conf.yml new file mode 100644 index 0000000..585974b --- /dev/null +++ b/roles/apt_listchanges/tasks/apt-listchanges-conf.yml @@ -0,0 +1,17 @@ +--- + +- name: apt-listchanges Config (/etc/apt/listchanges.conf) + ansible.builtin.template: + src: ../files/listchanges.conf + dest: /etc/apt/listchanges.conf + owner: root + group: root + mode: '0644' + +- name: Install packages if Debian based + apt: + name: "apt-listchanges" + state: present + update_cache: true + become: true + when: ansible_os_family == 'Debian' diff --git a/roles/apt_listchanges/tasks/main.yml b/roles/apt_listchanges/tasks/main.yml new file mode 100644 index 0000000..e6ce9d9 --- /dev/null +++ b/roles/apt_listchanges/tasks/main.yml @@ -0,0 +1,8 @@ +--- + +# to do list: + +- name: Include other yaml files + include_tasks: "{{ item }}" + with_fileglob: + - apt-listchanges-conf.yml diff --git a/roles/basic_common_settings/files/97-update.conf b/roles/basic_common_settings/files/97-update.conf new file mode 100644 index 0000000..fd2c714 --- /dev/null +++ b/roles/basic_common_settings/files/97-update.conf @@ -0,0 +1 @@ +%sudo ALL = NOPASSWD: /opt/scripts/update.sh diff --git a/roles/basic_common_settings/files/debian_earlyoom b/roles/basic_common_settings/files/debian_earlyoom new file mode 100644 index 0000000..bce2998 --- /dev/null +++ b/roles/basic_common_settings/files/debian_earlyoom @@ -0,0 +1,28 @@ +# Default settings for earlyoom. This file is sourced by /bin/sh from +# /etc/init.d/earlyoom or by systemd from earlyoom.service. + +# Options to pass to earlyoom +#EARLYOOM_ARGS="-r 60" + +# Examples: + +# Print memory report every second instead of every minute +# EARLYOOM_ARGS="-r 1" + +# Available minimum memory 5% +#EARLYOOM_ARGS="-m 5" + +# Available minimum memory 15% and free minimum swap 5% +#EARLYOOM_ARGS="-m 15 -s 5" + +# Avoid killing processes whose name matches this regexp +#EARLYOOM_ARGS="--avoid '(^|/)(init|X|sshd|firefox)$'" + +#prefer: +#EARLYOOM_ARGS="--prefer '(^|/)(telegram-desktop|element-desktop)$'" + +# See more at `earlyoom -h' +# +# +# +EARLYOOM_ARGS="-r 60 -m 3 --avoid '(^|/)(init|X|sshd|firefox)$' --prefer '(^|/)(signal-desktop|element-desktop)$'" diff --git a/roles/basic_common_settings/handlers/main.yml b/roles/basic_common_settings/handlers/main.yml new file mode 100644 index 0000000..ca7b901 --- /dev/null +++ b/roles/basic_common_settings/handlers/main.yml @@ -0,0 +1,8 @@ +--- + +- name: restart-earlyoom + ansible.builtin.service: + state: restarted + daemon_reload: yes + name: earlyoom + tags: molecule-notest diff --git a/roles/basic_common_settings/tasks/earlyoom.yml b/roles/basic_common_settings/tasks/earlyoom.yml new file mode 100644 index 0000000..deca055 --- /dev/null +++ b/roles/basic_common_settings/tasks/earlyoom.yml @@ -0,0 +1,17 @@ +--- + +- name: Install earlyoom if OS is based on Debian + ansible.builtin.package: + name: earlyoom + when: ansible_os_family == 'Debian' + +- name: Create earlyoom config + ansible.builtin.template: + src: ../files/debian_earlyoom + dest: /etc/default/earlyoom + owner: root + group: root + mode: '0644' + force: true + when: ansible_os_family == 'Debian' + notify: restart-earlyoom diff --git a/roles/basic_common_settings/tasks/main.yml b/roles/basic_common_settings/tasks/main.yml new file mode 100644 index 0000000..c714739 --- /dev/null +++ b/roles/basic_common_settings/tasks/main.yml @@ -0,0 +1,16 @@ +--- + +- name: Install useful packages + include_tasks: "useful_packages.yml" + +- name: Set up sudo (FreeBSD/OpenBSD) + include_tasks: "sudo.yml" + +- name: Set up earlyoom (Debian) + include_tasks: "sudo.yml" + +- name: Deploy update script + include_tasks: "update_script.yml" + +- name: Deploy ZSH config to /etc/skel + include_tasks: "zsh_skel.yml" diff --git a/roles/basic_common_settings/tasks/sudo.yml b/roles/basic_common_settings/tasks/sudo.yml new file mode 100644 index 0000000..75281f9 --- /dev/null +++ b/roles/basic_common_settings/tasks/sudo.yml @@ -0,0 +1,17 @@ +--- + +- name: "Install security/sudo (FreeBSD)" + ansible.builtin.package: + name: security/sudo + state: present + when: ansible_os_family == 'FreeBSD' + +- name: "Allow group wheel to use sudo (FreeBSD)" + ansible.builtin.lineinfile: + path: /usr/local/etc/sudoers + regexp: '%wheel ALL=\(ALL\) ALL' + line: '%wheel ALL=(ALL) ALL' + owner: root + group: wheel + mode: '0440' + when: ansible_os_family == 'FreeBSD' diff --git a/roles/basic_common_settings/tasks/update_script.yml b/roles/basic_common_settings/tasks/update_script.yml new file mode 100644 index 0000000..cec62a2 --- /dev/null +++ b/roles/basic_common_settings/tasks/update_script.yml @@ -0,0 +1,42 @@ +--- + +- name: "Ensure /opt/scripts/ exists" + ansible.builtin.file: + path: /opt/scripts + state: directory + mode: '0755' + +- name: "Create directory (/etc/sudoers.d)" + ansible.builtin.file: + path: /etc/sudoers.d + state: directory + owner: root + group: root + mode: '0755' + +- name: "Sudoers (/etc/sudoers.d/97-update.conf)" + ansible.builtin.template: + src: ../files/97-update.conf + dest: /etc/sudoers.d/97-update-conf + owner: root + group: root + mode: '0440' + when: ansible_os_family != 'OpenBSD' # sudo Installation must be fixed first for OpenBSD + +- name: "Template Update Script" + ansible.builtin.template: + src: ../templates/update.sh.j2 + dest: /opt/scripts/update.sh + owner: root + group: root + mode: u+rwx + when: ansible_os_family == 'Debian' + +- name: "Template Update Script" + ansible.builtin.template: + src: ../templates/update.sh.j2 + dest: /opt/scripts/update.sh + owner: root + group: wheel + mode: u+rwx + when: ansible_os_family == 'FreeBSD' or ansible_os_family == 'OpenBSD' diff --git a/roles/basic_common_settings/tasks/useful_packages.yml b/roles/basic_common_settings/tasks/useful_packages.yml new file mode 100644 index 0000000..cb46b1a --- /dev/null +++ b/roles/basic_common_settings/tasks/useful_packages.yml @@ -0,0 +1,26 @@ +--- + +- name: Install useful packages for servers if Debian-based + apt: + pkg: + - whois + - curl + - nmap + - traceroute + - zsh + - vim + - git + - net-tools + - wget + - apt-transport-https + - earlyoom + - gpg + - gpg-agent + - htop + #- duf #currently not in Debian stable, change when it is + - at + - pwgen + state: present + update_cache: true + become: true + when: ansible_os_family == 'Debian' diff --git a/roles/basic_common_settings/tasks/zsh_skel.yml b/roles/basic_common_settings/tasks/zsh_skel.yml new file mode 100644 index 0000000..2fa2653 --- /dev/null +++ b/roles/basic_common_settings/tasks/zsh_skel.yml @@ -0,0 +1,44 @@ +--- + +- name: Create ZSH config dir (/etc/zsh) + file: + path: /etc/zsh/ + owner: root + group: root + state: directory + when: ansible_os_family == 'Debian' + +- name: Create ZSH config dir (/etc/zsh) + file: + path: /etc/zsh/ + owner: root + group: wheel + state: directory + when: ansible_os_family == 'OpenBSD' + +- name: Download GRML ZSH config + get_url: + url: https://git.grml.org/?p=grml-etc-core.git;a=blob_plain;f=etc/zsh/zshrc;h=22ed16228d1e26b47322bd34b041f544aa5d458d;hb=refs/heads/master + dest: /etc/zsh/zshrc + mode: '0644' + retries: 10 + delay: 3 + when: ansible_os_family == 'Debian' or ansible_os_family == 'OpenBSD' + +- name: Copy ZSH config to /etc/skel/.zshrc + get_url: + url: https://git.grml.org/?p=grml-etc-core.git;a=blob_plain;f=etc/zsh/zshrc;h=22ed16228d1e26b47322bd34b041f544aa5d458d;hb=refs/heads/master + dest: /etc/skel/.zshrc + owner: root + group: root + mode: '0644' + when: ansible_os_family == 'Debian' + +- name: Copy ZSH config to /etc/skel/.zshrc + get_url: + url: https://git.grml.org/?p=grml-etc-core.git;a=blob_plain;f=etc/zsh/zshrc;h=22ed16228d1e26b47322bd34b041f544aa5d458d;hb=refs/heads/master + dest: /etc/skel/.zshrc + owner: root + group: wheel + mode: '0644' + when: ansible_os_family == 'OpenBSD' diff --git a/roles/basic_common_settings/templates/update.sh.j2 b/roles/basic_common_settings/templates/update.sh.j2 new file mode 100755 index 0000000..0f65c1f --- /dev/null +++ b/roles/basic_common_settings/templates/update.sh.j2 @@ -0,0 +1,23 @@ +#!/bin/sh +{% if ansible_os_family == "Debian" %} +export DEBIAN_FRONTEND=noninteractive +apt update +apt upgrade -y +apt autoremove -y +apt clean +{% endif %} +{% if ansible_os_family == "FreeBSD" %} +freebsd-update fetch +freebsd-update install +pkg upgrade +# Upgrades the Release to the latest updates +pkg-static install -f pkg +pkg bootstrap -f +pkg update +pkg upgrade +# Updates all packages +# Following this How To: https://www.cyberciti.biz/open-source/freebsd-13-released-how-to-update-upgrade-freebsd-12-to-13/ +{% endif %} +{% if ansible_os_family == "OpenBSD" %} +pkg_add -u && syspatch +{% endif %} diff --git a/roles/firewalld/.yamllint b/roles/firewalld/.yamllint new file mode 100644 index 0000000..8827676 --- /dev/null +++ b/roles/firewalld/.yamllint @@ -0,0 +1,33 @@ +--- +# Based on ansible-lint config +extends: default + +rules: + braces: + max-spaces-inside: 1 + level: error + brackets: + max-spaces-inside: 1 + level: error + colons: + max-spaces-after: -1 + level: error + commas: + max-spaces-after: -1 + level: error + comments: disable + comments-indentation: disable + document-start: disable + empty-lines: + max: 3 + level: error + hyphens: + level: error + indentation: disable + key-duplicates: enable + line-length: disable + new-line-at-end-of-file: disable + new-lines: + type: unix + trailing-spaces: disable + truthy: disable diff --git a/roles/firewalld/README.md b/roles/firewalld/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/roles/firewalld/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/roles/firewalld/handlers/main.yml b/roles/firewalld/handlers/main.yml new file mode 100644 index 0000000..9149a44 --- /dev/null +++ b/roles/firewalld/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for example_role diff --git a/roles/firewalld/meta/main.yml b/roles/firewalld/meta/main.yml new file mode 100644 index 0000000..952566f --- /dev/null +++ b/roles/firewalld/meta/main.yml @@ -0,0 +1,53 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + namespace: firewalld + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.1 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/roles/firewalld/molecule/default/Dockerfile.j2 b/roles/firewalld/molecule/default/Dockerfile.j2 new file mode 100644 index 0000000..19e7f6a --- /dev/null +++ b/roles/firewalld/molecule/default/Dockerfile.j2 @@ -0,0 +1,2 @@ +FROM debian:stable +RUN apt-get update && apt-get install python3-pip python-is-python3 sudo lsb-release -y diff --git a/roles/firewalld/molecule/default/converge.yml b/roles/firewalld/molecule/default/converge.yml new file mode 100644 index 0000000..8a63227 --- /dev/null +++ b/roles/firewalld/molecule/default/converge.yml @@ -0,0 +1,8 @@ +--- + +- name: Converge + hosts: all + tasks: + - name: "Include firewalld" + include_role: + name: "firewalld" diff --git a/roles/firewalld/molecule/default/molecule.yml b/roles/firewalld/molecule/default/molecule.yml new file mode 100644 index 0000000..c321303 --- /dev/null +++ b/roles/firewalld/molecule/default/molecule.yml @@ -0,0 +1,13 @@ +--- +dependency: + name: galaxy +driver: + name: docker +platforms: + - name: molecule + image: debian:stable + #pre_build_image: true +provisioner: + name: ansible +verifier: + name: ansible diff --git a/roles/firewalld/molecule/default/verify.yml b/roles/firewalld/molecule/default/verify.yml new file mode 100644 index 0000000..79044cd --- /dev/null +++ b/roles/firewalld/molecule/default/verify.yml @@ -0,0 +1,10 @@ +--- +# This is an example playbook to execute Ansible tests. + +- name: Verify + hosts: all + gather_facts: false + tasks: + - name: Example assertion + assert: + that: true diff --git a/roles/firewalld/tasks/main.yml b/roles/firewalld/tasks/main.yml new file mode 100644 index 0000000..714d917 --- /dev/null +++ b/roles/firewalld/tasks/main.yml @@ -0,0 +1,37 @@ +--- + +- name: install firewalld + package: + name: firewalld + state: present + +- name: "Make sure FirewallD is running" + ansible.builtin.service: + name: firewalld + enabled: yes + state: started + +- name: Open SSH port in firewall + ansible.posix.firewalld: + service: ssh + permanent: yes + state: enabled + immediate: yes +#this is seperate so you don't accidentally remove it + +- name: Open services in firewall + ansible.posix.firewalld: + service: "{{ item }}" + permanent: yes + state: enabled + immediate: yes + with_items: "{{ firewall_services }}" + +- name: Open ports in firewall + ansible.posix.firewalld: + port: "{{ item }}" + permanent: yes + state: enabled + immediate: yes + with_items: "{{ firewall_ports }}" + when: firewall_ports is defined diff --git a/roles/firewalld/tests/inventory b/roles/firewalld/tests/inventory new file mode 100644 index 0000000..878877b --- /dev/null +++ b/roles/firewalld/tests/inventory @@ -0,0 +1,2 @@ +localhost + diff --git a/roles/firewalld/tests/test.yml b/roles/firewalld/tests/test.yml new file mode 100644 index 0000000..cc7201e --- /dev/null +++ b/roles/firewalld/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - example_role diff --git a/site.yml b/site.yml new file mode 100644 index 0000000..fb8a4c0 --- /dev/null +++ b/site.yml @@ -0,0 +1,8 @@ +--- + +- name: Set up user account on all hosts + hosts: all + remote_user: root + + roles: + - basic_common_settings